Does WordPress send data about your blog to WordPress.org or Automattic?

Question

Yes, it does. See Ticket #16778 wordpress is leaking user/blog information during wp_version_check(). All the details are in /wp-includes/update.php:

if ( is_multisite( ) ) {
    $user_count = get_user_count( );
    $num_blogs = get_blog_count( );
    $wp_install = network_site_url( );
    $multisite_enabled = 1;
} else {
    $user_count = count_users( );
    $user_count = $user_count['total_users'];
    $multisite_enabled = 0;
    $num_blogs = 1;
    $wp_install = home_url( "https://wordpress.stackexchange.com/" );
}

$query = array(
    'version'           => $wp_version,
    'php'               => $php_version,
    'locale'            => $locale,
    'mysql'             => $mysql_version,
    'local_package'     => isset( $wp_local_package ) ? $wp_local_package : '',
    'blogs'             => $num_blogs,
    'users'             => $user_count,
    'multisite_enabled' => $multisite_enabled
);

$url="http://api.wordpress.org/core/version-check/1.6/?" . http_build_query( $query, null, '&' );

$options = array(
    'timeout' => ( ( defined('DOING_CRON') && DOING_CRON ) ? 30 : 3 ),
    'user-agent' => 'WordPress/' . $wp_version . '; ' . home_url( "https://wordpress.stackexchange.com/" ),
    'headers' => array(
        'wp_install' => $wp_install,
        'wp_blog' => home_url( "https://wordpress.stackexchange.com/" )
    )
);

$response = wp_remote_get($url, $options);

The user agent contains the URL of your installation, so all of these data are not anonymous anymore. To get some privacy back filter 'http_request_args' and change the data you don’t want to leak.

Here is a simple example to anonymize the UA string (from a recent blog article):

add_filter( 'http_request_args', 't5_anonymize_ua_string' );

/**
 * Replace the UA string.
 *
 * @param  array $args Request arguments
 * @return array
 */
function t5_anonymize_ua_string( $args )
{
    global $wp_version;
    $args['user-agent'] = 'WordPress/' . $wp_version;

    // catch data set by wp_version_check()
    if ( isset ( $args['headers']['wp_install'] ) )
    {
        $args['headers']['wp_install'] = 'http://example.com';
        $args['headers']['wp_blog']    = 'http://example.com';
    }
    return $args;
}

You can change that to …

add_filter( 'http_request_args', 't5_anonymize_ua_string', 10, 2 );

… and get the request URL as second parameter for your callback. Now you can check if the URL contains http://api.wordpress.org/core/version-check/ and ~~change all the values as want~~ cancel the request and send a new one. There is still no way to change just the URL, that’s why I created the patch in the ticket.

Related Posts:

Leave a Comment Cancel reply